[security] ReadHeaderTimeout not configured

[duglin]

Description

The http.server API in Go can be initialized with four different timeouts, including ReadHeaderTimeout. Without specifying a value for this timeout, the listener instance will become vulnerable to the Slowloris DoS attack.

code

Exploit Scenario

Attackers can exhaust server resources by opening multiple HTTP connections to the server, keeping the connections open, and slowly and continuously sending new HTTP header lines over the socket. This will eventually exhaust all open file handles.

Recommendations

Short term, specify appropriate timeout value for the ReadHeaderTimeout parameter. Long term, improve the code and SDK documentation to consider other means of handling
timeouts and preventing DoS attacks.

This was opened due to the Trail of Bits security review